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FEDERAL BUREAU OF INVESTIGATION 


Precedence: PRIORITY Date: 06/07/2007 


To: Cyber Attn: аш-- 
International Operations Attn: UC шалан 


Europe Unit 


Rome - Attn: Legat 
АГАТ 


Operational Technology Attn: 
b6 
b7C 
From: Seattle b7E 


Squad 11 - Cyber 
Contact: Detective 
Approved By: 
Drafted By: 
Case ID 48:4Á288A-SE-NE** (Pending) 一 | 
Title:  UNSUB(S); 
TIMBERLINE SCHOOL DISTRICT (VICTIM); 
COMPUTER INTRUSION - INTERNET EXTORTION 
Synopsis: Request to open captioned investigation. 


Administrative: Reference the following communications: 


06/07/2007 telcal between petective| | |] Бэ 
Seattle Division Cyber Task Force, and ROME АГАТ с 


06/07/2007 telc ГП 1] 
Seattle Division, and SSA CACU. 
Details: On 06/06/2007, Seattle Division was contacted by 
Lacey Police Department (LPD), Lacey, WA, regarding numerous 


bomb threats and DDOS attacks received at the Timberline 
School District, Lacey, WA. Below are a time-line of events: 


6 


"To: Cyber Кс” 
Ке: 288A-SE-NEW, 06/07/2007 


05/30/2007 - Timberline High School evacuation due 
to hand written bomb threat note. 


06/04/2007 - Timberline High School evacuation due 
to bomb threat email from sender: 
UNSUB(s) also advised a computer attack 1 he Lacey 
School District, which resulted in a DDOS attack totaling over 
80,000,000 hits. 


06/05/2007 - Timberline ты vacuation due 
to bomb threat email from sender: 


06/06/2007 - Timberline 
to bomb threat email from sender: 


06/07/2007 - Timberline High School received 
additional email from UNSUB(s). Details unknown at present 
time. 


LPD and the Washington State Patrol (WSP) continue 
to perform school evacuations and bomb sweeps with negative 
results. Parents and school district employees have informed 
local television stations and newspapers, which aired the 
story on June 6, 2007. LPD has requested investigative 
assistance from the Northwest Cyber Crime Task Force. 


student at Timberline High School, 

appears not to be the subj 8e ЕЕ шэг Ka: 2 

шини teachers from Timbes ine High School provided a 
ist o 


and DDOS attack. 


06/03/2007, advising "Keep your head up. is described 
by teachers as a self proclaimed computer H 
ly bypasses the school computer security measures. 
S computer is in LPD custody and forensic results are 
pending. Initial interview of ИШ provided negative 
results. 
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“То: Cyber ee 
Re: 288A-SE-NEW, 06/07/2007 


On 06/07/2007, Detective[ ____________| и5Р, апа 
SA Seattle Division, contacted AUSA 
Western District of Washington, who agreed to 


prosecute captioned matter. 
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“To: Cyber кош: ТА 
Re: 288A-SE-NEW, 06/07/2007 


LEAD (8): 
Set Lead 1: (Info) 
CYBER 


AT WASHINGTON, DC 


For information. 


Set Lead 2: (Info) 


INTERNATIONAL OPERATIONS 


AT WASHINGTON, DC 


For information. 
Set head 3: (Action) 
ROME 


AT ROME, ITALY 


Set Lead 4: (Info) 
OPERATIONAL TECHNOLOGY 


AT QUANTICO, VA 


For information. 
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“Аб 106 (Rev. 8/98) Search Warrant 


United States District Court 


WESTERN DISTRICT OF WASHINGTON 


In the Matter of the Search of ЖА Ó > < ( l J 


(Name, address or brief description of person or property to be searched) 
SEARCH WARRAN p 


any computer accessing electronic message(s) 
directed to administrator(s) of MySpace account 
“Timberlinebombinfo” and opening message(s) 
delivered to that account by the government. 


FILED UNDER SEAL 


То: NORMAN В. SANDERS, JR., and any Authorized Officer of the United States. 


Affidavit(s) having been made before me by NORMAN B. SANDERS, JR., who has reason to believe that ( ) on the person of or (X ) on 
the property or premises known 25 (name, description and/or location) 


Any computer accessing electronic message(s) directed to administrator(s) of MySpace account 
“Timberlinebombinfo” and opening message(s) delivered to that account by the government. 

in the Western District of Washington, there is now concealed a certain person or property, namely: 

(describe the person or property) 
Network level messages, IP addresses, MAC addresses, other variables, and certain registry-type information. 
THIS WARRANT DOES NOT SEEK AUTHORIZATION TO OBTAIN THE CONTENT OF ANY 
ELECTRONIC COMMUNICATIONS. 


I am satisfied that the affidavit(s) and any record testimony establish probable cause to believe that the person or property so described is now 
concealed on the person or premises above-described and establish ground for the issuance of this warrant. 


YOU ARE HEREBY COMMANDED о search on or before Јул 22 ‚ 2007 pa ђ 
(1 Ола) 


(not to exceed 10 days) the person 0 325. DUM above for the person or property specified, serving this warrant and making the searc 
daytime -- 6:00 AM to 10:00 РМ) we any time day or night as I find reasonable cause has been established) and if the person or property 
be found. there to seize same, leaving a copy of this warrant and receipt for the person or property taken, and prepare a written inventory of the 


person or property seized and promptly return this warrant to а United States Magistrate Judge аз required by law. 


June ]2- , 2007. Z Ил | at Seattle, Washington 


Date and Time City and State 
JAMES P. DONOHUE, U.S. Magistrate Judge — Z= i sade 
Name and Title óf Judicial Officer of Judicial Officer 


CERTIFIED TRUE. COPY 
ATTEST: BRUCE RIFKIN 
Clerk, U.S. District Court 

Western District of Washington 


Ву... 


USAO No. 2007R00791 


DATE WARRANT RECEIVED DATE & TIME WARRANT EXECUTED COPY OF WARRANT & RECEIPT 
| FOR ITEMS LEFT WITH 


INVENTORY MADE IN THE PRESENCE OF - : | 


INVENTORY OF PERSON OR PROPERTY TAKEN PURSUANT TO THE WARRANT 


mel CERTIFICATION 2 E 


I swear that this inventory is a true and detailed account of the person or property taken by me on the warrant. 


Subscribed, sworn to, and returned to me this date. 


U.S. Judge or Magistrate Date 


СЕР м За 
АО 106 (Rev. 8/98) Search Warrant 


United States District Court 


WESTERN DISTRICT OF ea 


КЕЗІНДЕ 5 


In the Matter of the Search of wee LODGED ..— RECEIVED /Ж n Ó 7- Sl | / ; 


(Name, address or brief description of person or property to be searched) J U N 2 1 2007 SEARCH WA T 


any computer accessing electronic message(s) : 
directed.to administrator(s) of MySpace account WESTERN nx JS DISTRICT co es АБЕ l: 
“Timberlinebombinfo” and opening message(s) PUTY 


delivered to that accourit by the government. | Мше UNDER SEAL 


To: NORMAN B. SANDERS, JR., and any Authorized Officer of the United States. 


Affidavit(s) having been made before me by NORMAN В. SANDERS, JR., who has reason to believe that ( ) on the person of or (X ) on 
the property or premises known as (name, description and/or location) 


Any computer accessing electronic message(s) directed to administrator(s) of MySpace account 
*Timberlinebombinfo" and opening message(s) delivered to that account by the government. 

in the Western District of Washington, there is now concealed a certain person or property, namely: 

(describe the person or property) 
Network level messages, IP addresses, MAC addresses, other variables, and certain registry-type information. 
THIS WARRANT DOES NOT SEEK AUTHORIZATION TO OBTAIN THE CONTENT OF ANY 
ELECTRONIC COMMUNICATIONS. 


I am satisfied that the affidavit(s) and any record testimony establish probable cause to believe that the person or property so described is now 
concealed on the person or premises above-described and establish ground for the issuance of this warrant. 


YOU ARE HEREBY COMMANDED ь search on or before Jy == 2 p 


(not to exceed 10 days) the резоп AE ЕУ ae for the person or property specified, serving this warrant and making the search (ФМ Oraj- 
daytime -- 6:00 AM to 10:00 PM) ae 3 УН 1 day or night as I find reasonable cause has been established) and if the person or property 
be found there 10 seize same, leaving a copy of this warrant and receipt for the person or property taken, and prepare a written inventory of the 


person or property seized and promptly return this warrant to a United States Magistrate Judge as required by law. 


June 12-.2007 2 b A at Seattle. Washington . i Е 
Date and Time X. City and State 


JAMES P. DONOHUE, U.S. Magistrate Judge — 
Name and Title óf Judicial Officer 


of Judicial Officer 


USAO No. 2007R00791 


DATE WARRANT RECEIVED | DATE & TIME WARRANT EXECUTED COPY OF WARRANT & RECEIPT 
FOR ITEMS LEFT WITH 


Ç - 12. -Lee G-13-25e73 5: дрм~ м/м 


INVENTORY MADE IN THE PRESENCE OF ` | 
N/A ~ Ехёсолёл» ом INTERNE Г 


INVENTORY OF PERSON OR PROPERTY TAKEN PURSUANT TO THE WARRANT : 
| CDROM Containing C. PAN BESVUTS , 


| . CERTIFICATION 


I swear that this inventory is a true and detailed account of the person or property taken by me on the warrant. 
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Timberline High School 
Parent Forum 
June 12, 2007 
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Timberline High School 
Parent Forum 
June 12, 2007 


“Printed Name | Street Address |.. E-Mail Address 


ЕЙ . Phone . ‘Signature. | 
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Parent Forum 
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Timberline High School 
Parent Forum 
June 12, 2007 
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Wednesday, June 13, 2007 


Bomb threat at high school 
downplayed by local police 
department. 


The Associated Press 


LACEY Wash. — Technology savvy student holds Timberline High School hostage. The 
suspect is still unknown after several bomb threats and 5 days of school evacuations. 
Anonymous bomb threats to High Schools are a growing trend in rural America. 


Timberline High School is the latest victim in an increasing trend of computer related extortion 
schemes. These schemes all involve a similar pattern: several threats made over a week by 
students utilizing technology. These threats receive low media attention. School officials and 
Law Enforcement downplay the risk associated with the threats and disregard pleads from 
concerned parents and students. 


Although similar incidents have occurred in Kentucky, Michigan, and Virginia, the Timberline ` 
threat shows an escalation in sophistication and high computer hacking skills. 


[Statistics to come on each threat. Including: duration of threat, cost estimate for damage, and 
physiological factors] 


The most significant difference with the Timberline threat is the use of My Space and obfuscated 
emails. According to sources at Timberline High School, the subject uses other student's emails 
to send the bomb threais, most often going by the name of "Doug." Additionally, the subject has 
set up a My Space page to taunt students. According to "Doug", # students have joined the My 
Space page. A frenzy of students are trying to identify "Doug", yet none have succeeded. 


in response to the student's race to identify the suspect, "Doug" comments 
[Place comment here] 


in an unprecedented move, the AP obtained an exclusive interview with the person 
believed to be behind the Timberline High School email bomb threats and posting 
information on “MySpace” account “Timberlinebombinfo.” 


“Nicky123456” possesses “sophisticated computer hacking skills.” International servers 
are “compromised systems” being used to send the emails to terrorize the school. This 
method is virtually untraceable. 


Nicky123456 is frustrated by Officials who “are hiding important information from the 
students and the rest of the Timberline population.” Parents are scared because the only 
thing they are being told is “1 assure you they are safe.” “We can’t give out any email 
information because it will compromise the evidence.” These statements made by 
Nicky12345, are apparent references to assurances being made by both school and law 
enforcement officials at last night’s Timberline High School forum. 


Another reason for the threats relate to the unspecified actions of another student. (2) 


Nicky123456 goes on to say: “Also, about the “hit list” some people say it’s a rumor, some 
say it isn’t. Maybe we can find out on the 20°.” 


According to Nicky123456, the FBI and Police will not be able to solve this case: “There 
have been lots of comments on my myspace about how they can trace it, it’s not likely to 
happen and | see myself as victorious.” 


School officials have given parents and students little assurances of the threats ending soon. 
Timberline Principle Dave Lehnis stated, "While the administration and law enforcement believes 
the school is safe and secure, we understand if parents want to keep their students at home and 
we-will work with them to get the homework they need." 


The emotional toll on the students can be seen by the significant absentee numbers. If school 
officials and Law Enforcement are not taking this threat seriously, the parents are. 
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FBI URGENT REPORT 


Precedence: IMMEDIATE Date: 06/14/2007 
To: Director 
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Cyber 
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Operational Technology 
International Operations 
Rome 


From: Seattle 
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Approved By: SA ши 


Drafted By: 


Subject/Title/Case ID #: _288A-SE-93709 


(JUVENILE) - SUBJECT b3 
TIMBERLINE HIGH SCHOOL - VICTIM b6 
COMPUTER INTRUSION - THREAT b7C 


Purpose/Synopsis: OTHER MATTER WARRANTING THE IMMEDIATE 
ATTENTION OF FBIHO EXECUTIVES 


UPDATE 
URGENT REPORT 


On 06/14/2007, at approximately 2:00 am, Pacific 
Standard Time, the below listed juvenile was arrested by the 
police Department 


b3 


5 b6 
RACE: b7C 
ADDRESS: 

MISC: 


was identified as the subject of the 
investigation after a successful deployment of a court authorized 


2 e e 
40% 
То: 


Director From: Seattle 
Re: 06/14/2007 


Computer and Internet Protocol Address Verifier (CIPAV). The 


ыз 
b6 
b7C 
b7E 


Investigation in Seattle continues. 


BACKGROUND 


On 06/06/2007, the Seattle Field Office was contacted 
by the Lacey Police Department (LPD), Lacey, WA, regarding email 
bomb threats and Distribute Denial of Service (DDOS) attacks 
received by Timberline High School, 6120 Mullen Road SE, Lacey, 
WA, 98503, in the North Thurston Public School District. 


The email threats commenced on 06/04/2007, and continue 
to the present. To date, there have been three email threats 
that resulted in three separate deployments of K-9 Units from the 
Washington State Patrol and severe disruption in routine school 
operations. There has also been an increase in local media 
coverage of the incidents and growing parental concerns. 


The email content has repeatedly demeaned school 
faculty and teachers and taunts law enforcement. The UNSUB(S) 
also posted three of the email threats in the "Comments" section 
of "The Olympian" news online website. 


Investigation conducted by LPD identified thr 
Internet Protocol (IP) addresses being utilized 


b7D 

by LEGAT Rome. b7E 
LPD conducted several interviews on persons of 

interest, however, no subject have been identified. Logical 

investigative leads are being pursued. 


FBI Seattle is developing a strategy to deploy a 
Computer and Internet Protocol Address Verifier (CIPAV) and 
drafting a search warrant affidavit. Seattle will also 
coordinate the investigation with LEGAT Rome and the Behavioral 
Analysis Unit. 


FBI involvement in the investigation will not be 
revealed at this time to facilitate a scenario through which the 
CIPAV could be successfully deployed. 


Director 9 Seattle р 


06/14/2007 


Graduation at Timberline High School is scheduled for 
‚06/15/2007, and the last day of instruction is 06/21/2007. 


(URGENT REPORT 06/07/2007) 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: IMMEDIATE Date: 06/11/2007 
To: Operational Technology Attn: СЕАУ 
UC 
SS 
New York . Attn: 
SS 
SA 


From: Seattle 


C cee 
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Approved By: BE 


Drafted By: 人 -一 
Case ID %:/288А-5Е-93709 (Pending) --5 


Title:  UNSUB(S); 
TIMBERLINE SCHOOL DISTRICT (VICTIM); 
COMPUTER INTRUSION - INTERNET EXTORTION 


Synopsis: Request CEAU assistance for deployment of CIPAV search 
warrant and pen register. 


Administrative: Reference 06/08/2007 telcal between 68А| | b6 
[ _____|СЕАЏ, and SA Seattle Division. b7C 
b7E 


Details: On 06/06/2007, Seattle Division was contacted by Lacey 
Police Department (LPD), Lacey, WA, regarding numerous bomb threats 
and DDOS attacks received at the Timberline School District, Lacey, 
WA. Below are a time-line of events: 


05/30/2007 - Timberline High School evacuation due to 
hand written bomb threat note. 


06/04/2007 - Timberlj i i to 
bomb threat email from sender: b6 
[| IP Address UNSUB(s) also advised a computer attack will hit bic 


the Lacey School District, which resulted in a DDOS attack totaling 
over 80,000,000 hits. 


06/05/2007 - Timberline High School evacuation due to 
bomb threat email from сюер pe SE b6 


b7C 
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То: Operational e. From: Seattle 
Re: 288A-SE-93709, 06/11/2007 


06/06/2007 - Timberli i i due to 
bomb threat email from sender: b6 


b7C 
06/07/2007 - Timberline High School received additional 
email from UNSUB(s). Details unknown at present time. 
06/08/2007 - MySpace account Timberlinebombinfo posted 
bomb threat emails on the comments section of www.theol ian.com 
b6 
b7C 
b7E 
telephone 
Verizon reported IP Address 70.19.60.220 has been online 
continuously for approximately 96 hours. 
LPD and the Washington State Patrol (WSP) continue to 
perform school evacuations and bomb sweeps with negative results. 
Parents and school district employees have informed local 
television stations and newspapers, which aired the story on June 
6, 2007. ТРО has requested investigative assistance from the 
Northwest Cyber Crime Task Force. 
b7E 
ing in an undercover 
j : b7E 
Seattle also requests New York Division 8 
b7E 


The computer in S residence 


may possibly be compromised and controlled through VNC on port 
5800, 5801, 5900 or 5901. The user(s) of this computer may 
possibly be associated to MySpace user Timberlinebombinfo. 


Questions regarding captioned investigation should be 
directed to ВА] Seattle Division, | be 


b7C 


* То: Operational ® _ From: Seattle ө 
Re: 288A-SE-93709, 06/11/2007 · 
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m хас 


То: Operational б... From: Seattle 
Ке: 288A-SE-93709, 06/11/2007 


LEAD (в): 
Set Lead 1: (Info) 
NEW YORK 


AT NEW YORK, NY 


New York is requested to 


Set Lead 2: (Info) 
OPERATIONAL TECHNOLOGY 


AT QUANTICO, VA 


CEAU is requested to program a Computer and Internet 


` Protocol Address Verifier (CIPAV) to be used in relation to 


captioned investigation. 
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